JP2013109731A - Vehicle controller - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect malfunctions of a sensor or a processor.SOLUTION: A vehicle controller 1 includes: a duplexed sensor 2; a first processor 11; and a second processor 12. The sensor 2 includes: a first sensor 3 that generates a first output signal S1; and a second sensor 4 that generates a second output signal S2. The first output signal S1 is input to the first processor 11, and the second output signal S2 is input to the second processor 12. The processors 11 and 12 have signal communication sections 23 and 33 for obtaining the first and second output signals S1 and S2. The processors 11 and 12 have signal reference sections 25 and 35 that determine malfunction of any of the sensors and the processors, referring to the first and second output signals S1 and S2. The processors 11 and 12 can include result communication sections 26 and 36 that obtain determination results R1 and R2, and result reference sections 27 and 37 that refer to results.

Description

  The present invention relates to a vehicle control device mounted on a vehicle. The present invention can be applied to, for example, a vehicle control device for controlling a control object that affects the behavior of the vehicle, for example, a driving device for driving and a braking device.

  Patent Document 1 describes a system that includes two control devices that input a signal from one sensor and apply the same arithmetic processing to an input signal, and that detects an abnormality by comparing the calculation results of the control devices. Yes.

JP-A-6-274361

  In the configuration of the prior art, even if the input signal from the sensor is abnormal, if the control device is normal, the same calculation result can be obtained, so that there is a problem that abnormality of the sensor and its input system cannot be detected.

  The present invention has been made in view of the above problems, and an object thereof is to provide a vehicle control device capable of detecting an abnormality associated with a sensor.

  Another object of the present invention is to provide a vehicle control device capable of detecting an abnormality of a duplexed duplex sensor for detecting the same event and an abnormality of a processing device.

  The present invention employs the following technical means to achieve the above object.

  According to the first aspect of the present invention, the first sensor (3) for detecting one event and generating the first output signal (S1), and the second output signal (S2) for detecting the same event. ) And the second sensor (4), the first sensor is connected, the first processing device (11) to which the first output signal (S1) is input, and the second sensor are connected. , The second processing device (12) to which the second output signal (S2) is input, and the signal communication unit (23, 33, 43,...) For obtaining the first output signal and the second output signal. 153, 353) and a signal verification unit (25, 35, 45, 154, 354) that compares the first output signal and the second output signal to determine abnormality of the sensor or the processing device. Features.

  According to this configuration, a configuration is adopted in which one of the two output signals is input only to the first processing device and the other is input only to the second processing device. Even in this case, an abnormality related to the sensor can be detected. For example, an abnormality in any of the sensor, the first processing device, and the second processing device is detected.

  According to the second aspect of the present invention, all the processing devices perform normal control processing (22, 32, 42, 159, 359) for executing normal control processing based on an output signal, and sensors or processing by the signal verification unit. When a device abnormality is determined, a fail-safe control unit (28, 38, 48, 161-163, 263, 272, 361, 363, 383-385) that executes fail-safe processing instead of the normal control unit is used. It is characterized by providing. According to this configuration, fail-safe control can be provided when an abnormality is determined.

  The invention described in claim 3 further includes a signal evaluation unit (24, 34, 44, 152, 352) for evaluating whether the first output signal or the second output signal is within a normal range. Features. According to this configuration, in addition to the abnormality detection by the signal matching unit, it is possible to detect an abnormality of only the sensor depending on whether the output signal is within the normal range.

  The invention described in claim 4 is characterized in that the signal communication unit and the signal matching unit are provided in the first processing device and / or the second processing device. According to this configuration, an abnormality related to the sensor can be detected in at least one of the first processing device and the second processing device.

  The invention according to claim 5 is characterized in that the signal communication unit and the signal matching unit are provided in the third processing device (313) which is not connected to the first sensor or the second sensor. And According to this configuration, the abnormality related to the sensor can be detected in the third processing apparatus or also in the third processing apparatus.

  In the invention according to claim 6, the signal communication unit and the signal collation unit are provided in a plurality of processing devices, and further, result communication for obtaining the determination results (R1, R2) in the plurality of signal collation units. Unit (26, 36, 46, 155, 156, 355, 356) and a result collating unit (27, 37, 47, 157, 158, 357) for collating a plurality of results and determining whether the results are the same. 358). According to this configuration, it is possible to search for the cause of the abnormality based on a plurality of determination results. For example, depending on when multiple signal verification results are "equivalent" and identical, when multiple signal verification results are "not equivalent" and identical, or when multiple signal verification results are not identical The cause of the abnormality can be searched.

  In the invention according to claim 7, the signal communication unit and the signal collation unit are provided in the three processing devices (11, 12, 313), and further, the determination results (R1- A result communication unit (46, 355, 356) for obtaining R3), and a majority processing unit (40, 381, 382) for identifying an abnormal processing device based on a majority of a plurality of results. According to this configuration, an abnormal processing apparatus can be identified based on the results of a plurality of determinations.

  Note that the reference numerals in parentheses described in the claims and the above-described means indicate the correspondence with the specific means described in the embodiments described later as one aspect, and are technical terms of the present invention. It does not limit the range.

It is a block diagram showing a control device for vehicles concerning a 1st embodiment to which the present invention is applied. It is a flowchart which shows the action | operation of 1st Embodiment. It is a block diagram which shows the control apparatus for vehicles which concerns on 2nd Embodiment to which this invention is applied. It is a flowchart which shows the action | operation of 2nd Embodiment. It is a block diagram which shows the control apparatus for vehicles which concerns on 3rd Embodiment to which this invention is applied. It is a flowchart which shows the action | operation of 3rd Embodiment.

  A plurality of modes for carrying out the present invention will be described below with reference to the drawings. In each embodiment, parts corresponding to the matters described in the preceding embodiment may be denoted by the same reference numerals, and redundant description may be omitted. When only a part of the configuration is described in each mode, the other modes described above can be applied to the other parts of the configuration. Further, in the following embodiments, the correspondence corresponding to the matters corresponding to the matters described in the preceding embodiments is indicated by adding reference numerals that differ only by one hundred or more, and redundant description may be omitted. . Not only combinations of parts that clearly show that combinations are possible in each embodiment, but also combinations of the embodiments even if they are not explicitly stated unless there is a problem with the combination. Is also possible.

(First embodiment)
FIG. 1 shows a configuration of a first embodiment to which the present invention is applied. The vehicle control device 1 is mounted on a vehicle. The vehicle control device 1 provides a vehicle behavior control device for controlling the behavior of the vehicle. The vehicle control device 1 is configured to control the traveling behavior of the vehicle to a desired state according to a request from a user including the driver of the vehicle and further according to an actual behavior of the vehicle. The vehicle control device 1 controls a driving force for traveling and a braking force for traveling. The vehicle control device 1 is a control system for a hybrid vehicle that can selectively drive the vehicle by at least one of an internal combustion engine and an electric motor.

  The vehicle control device 1 includes a sensor (SNR) 2 for inputting information necessary for controlling the behavior of the vehicle. The sensor 2 is a request input sensor for inputting a request from a vehicle user. The sensor 2 provides a duplex sensor that is duplicated to detect the same event. The duplexed sensor 2 contributes to improvement of reliability. The sensor 2 includes a plurality of sensors (SNR1, SNR2) 3 and 4 that detect the same event. For example, the sensor 2 detects an operation amount of an accelerator pedal operated by a driver of the vehicle, that is, a depression amount. The plurality of sensors 3 and 4 are connected to an accelerator as a detection target and output output signals S1 and S2 corresponding to the operation amount of the accelerator pedal. When the mechanical part and the electrical part of the sensor 2 are normal, the output signal S1 of the sensor 3 and the output signal S2 of the sensor 4 match. The sensor 3 is also called the first sensor 3. The sensor 4 is also called a second sensor 4.

  The vehicle control device 1 includes a traveling device (VHDD) 5 that changes the behavior of the vehicle. The traveling device 5 includes a plurality of devices 5a and 5b that affect the behavior of the vehicle. The traveling device 5 includes devices 5 a and 5 b that accelerate or decelerate the rotational speed of the vehicle wheel 6. The traveling device 5 includes devices 5a and 5b that adjust the driving force applied to the wheels of the vehicle. The device 5a is provided by, for example, an internal combustion engine (EG). The device 5b is provided by, for example, a motor generator (MG). Since the devices 5a and 5b can also reduce the rotational speed of the wheel 6, they are also devices that brake the rotation of the wheel 6. The traveling device 5 is a so-called hybrid drive device that can drive the wheels 6 by at least one of an internal combustion engine and a motor generator. Furthermore, the traveling device 5 may include a device that adjusts the braking force applied to the vehicle wheel 6. Such a device is provided, for example, by a brake device that brakes the rotation of the wheel 6.

  The vehicle control device 1 includes an electronic control system 7 that functions as a vehicle behavior control device that controls the traveling device 5. The electronic control system 7 can be constructed by one or a plurality of electronic control units (ECUs) 8, 9, 10. The electronic control device includes a processing device called a microprocessing unit (MPU). The processing device is provided by a microcomputer provided with a computer-readable storage medium. The storage medium stores a computer-readable program non-temporarily. The storage medium can be provided by a semiconductor memory or a magnetic disk. The program is executed by the processing device to cause the processing device to function as a device described in this specification, and to cause the processing device to function so as to execute the control method described in this specification. The means provided by the processing device can also be referred to as a functional block or module that achieves a predetermined function.

  The electronic control system 7 includes a first electronic control unit (HV-ECU) 8 that receives the output signal S1 of the first sensor 3. The first electronic control device 8 is also called an HV control device 8 for controlling the traveling device 5. The HV control device 8 executes arithmetic processing for comprehensively controlling the internal combustion engine 5a and the motor generator 5b. The HV control device 8 includes a first processing device (MPU1) 11.

  The electronic control system 7 includes a second electronic control unit (EG-ECU) 9 that receives the output signal S2 of the second sensor 4. The second control device 9 is also called an EG control device 9 for controlling the internal combustion engine 5a. The HV control device 8 and the EG control device 9 are communicably connected. The EG control device 9 includes a second processing device (MPU2) 12. The EG control device 9 controls the internal combustion engine 5a in response to a command from the HV control device 8. With respect to the control of the internal combustion engine 5a, a master-slave control system is constructed in which the HV control device 8 is the upper level and the EG control device 9 is the lower level.

  Here, one of the two sensors 3 and 4 is connected to only one of the two processing devices 11 and 12, and the other of the two sensors 3 and 4 is connected to only the other of the two processing devices 11 and 12. ing. That is, the plurality of processing apparatuses 11 and 12 and the plurality of sensors 3 and 4 are electrically connected so as to be able to transmit signals in a one-to-one correspondence.

  The electronic control system 7 includes a third electronic control unit (MG-ECU) 10. The third electronic control device 10 is also called an MG control device 10 for controlling the motor generator 5b. The MG control device 10 is communicably connected to the HV control device 8 and the EG control device 9. The MG control device 10 includes a third processing device (MPU3) 13. The MG control device 10 controls the motor generator 5b in response to a command from the HV control device 8. With respect to the control of the motor generator 5b, a master-slave control system is constructed in which the HV control device 8 is the upper level and the MG control device 10 is the lower level.

  Communication between the HV control device 8 and the EG control device 9, between the HV control device 8 and the MG control device 10, and between the EG control device 9 and the MG control device 10 is a CAN (Controller Area Network). It can be provided by a communication line and a communication processing unit.

  The first processing device 11 and the second processing device 12 construct a mutual monitoring system that detects that there is an abnormality in one of them by monitoring the operating state of each other. In order to construct a mutual monitoring system, the first processing device 11 and the second processing device 12 include a plurality of functional blocks 21-28 and 31-38. The functional blocks 21-28 included in the first processing device 11 and the functional blocks 31-38 included in the second processing device 12 provide the same or corresponding functions. Hereinafter, description will be given mainly with reference to the functional blocks 21 to 28 of the first processing apparatus 11.

  The signal processing units (SGPM) 21 and 31 process the output signal S1 from the sensor 3. The signal processing unit 21 processes the output signal S1. The signal processing unit 31 processes the output signal S2. The processing by the signal processing unit 21 and the signal processing unit 31 is set so that the output signals S1 and S2 can be confirmed to have a predetermined relationship by comparing the processing results. The processing by the signal processing unit 21 and the signal processing unit 31 can be the same processing. The processing in the signal processing units 21 and 31 is, for example, processing for converting the output signals S1 and S2. More specifically, the analog output signals S1 and S2 are converted into digital data. In the following description, the processing results of the output signals S1 and S2 are simply referred to as output signals S1 and S2.

  The normal control units (CNTM) 22 and 32 execute a predetermined normal control process. The normal control unit 22 executes a control process for comprehensively controlling the internal combustion engine 5a and the motor generator 5b. For example, the normal control unit 22 calculates a control amount for instructing the EG control device 9 and the MG control device 10 based on the output signal S1. The normal control unit 32 executes a control process for controlling the internal combustion engine 5a in accordance with a command from the HV control device 8. All the processing apparatuses 11, 12, and 13 include a normal control unit that executes a normal control process based on the output signal.

  The hybrid vehicle has an internal combustion engine 5a and a motor generator 5b as driving power sources. Therefore, it is necessary to generate the torque necessary for running the vehicle by distributing it to the internal combustion engine 5a and the motor generator 5b. The normal control unit 22 is responsible for this distribution function. The EG control device 9 and the MG control device 10 control the internal combustion engine 5a and the motor generator 5b in accordance with a command from the HV control device 8. The normal control unit 22 can be configured to use both an output signal S1 that is directly input and an output signal S2 that is input indirectly via the EG control device 9. Thereby, in the 1st processing apparatus 11, high reliability is acquired. Further, the normal control unit 32 can be configured to use both the output signal S2 that is directly input and the output signal S1 that is input indirectly via the HV control device 8. Thereby, in the 2nd processing apparatus 12, high reliability is acquired.

  The signal communication units (STRM) 23 and 33 exchange the signals processed in the signal processing units 21 and 31 with each other. The first processing device 11 transmits the output signal S1 to the second processing device 12. Further, the first processing device 11 receives the output signal S <b> 2 from the second processing device 12. The second processing device 12 transmits the output signal S2 to the first processing device 11. Further, the second processing device 12 receives the output signal S <b> 1 from the first processing device 11.

  The signal evaluation units (SGVM) 24 and 34 evaluate the output signals S1 and S2 from the sensors 3 and 4 based on a preset evaluation rule. The signal evaluation units 24 and 34 are also called determination units that determine whether the output signals S1 and S2 are normal. The signal evaluation units 24 and 34 evaluate whether or not the first output signal S1 or the second output signal S2 is within the normal range. The signal evaluation units 24 and 34 determine whether or not the output signal directly input from the sensors 3 and 4 is within the normal range. The signal evaluation unit 24 evaluates whether or not the output signal S1 is within a preset normal range. When the output signal S1 is outside the normal range, the signal evaluation unit 24 determines an abnormality in the output signal S1, that is, an abnormality related to the sensor 3. The signal evaluation unit 34 evaluates whether or not the output signal S2 is within a preset normal range. When the output signal S2 is outside the normal range, the signal evaluation unit 34 determines an abnormality in the output signal S2, that is, an abnormality related to the sensor 3.

  Signal collating units (CMPM) 25 and 35 collate the output signals S1 and S2 from the sensors 3 and 4. The signal verification units 25 and 35 are also called determination units that determine whether or not the output signals S1 and S2 have a predetermined relationship. For example, the signal matching units 25 and 35 determine whether or not the output signals S1 and S2 are equivalent. Specifically, the signal matching units 25 and 35 determine whether or not the output signals S1 and S2 indicate the same operation amount of the accelerator pedal. The signal communication units 23 and 33 and the signal matching units 25 and 35 are provided in the plurality of processing devices 11 and 12.

  The determination in the signal matching units 25 and 35 provides a determination as to whether the transmission path of the output signals S1 and S2 until reaching these processes is normal or abnormal. The signal checking unit 25 checks the output signal S1 that is directly input and the output signal S2 that is obtained through the processing by the second processing device 12. The signal checking unit 35 checks the output signal S2 that is directly input and the output signal S1 obtained through the processing by the first processing device 11. The result of the verification indicates whether there is an abnormality. For example, when the output signals S1 and S2 are not equivalent, it is considered that there is some abnormality in the signal transmission path related to one of the output signals S1 and S2. Here, an abnormality of the sensor 3, an abnormality of the sensor 4, an abnormality of the signal line, an abnormality of the HV control device 8, an abnormality of the EG control device 9, and the like can be considered.

  The result communication units (RTRM) 26 and 36 exchange the results of determination in the signal verification units 25 and 35 with each other. The first processing device 11 transmits the determination result R1 to the second processing device 12. Further, the first processing device 11 receives the determination result R2 from the second processing device 12. The second processing device 12 transmits the determination result R2 to the first processing device 11. Further, the second processing device 12 receives the determination result R1 from the first processing device 11. The result communication units 26 and 36 obtain the determination results R1 and R2 in the plurality of signal matching units 25 and 35.

  The result collating units (RCPM) 27 and 37 collate the results R1 and R2. The result collating units 27 and 37 are also called determination units that determine whether the results R1 and R2 match. The result collating units 27 and 37 collate a plurality of results R1 and R2, and determine whether the results are the same. According to this configuration, the cause of the abnormality can be searched based on the results R1 and R2. For example, when the results R1 and R2 are “equivalent” and the same, the results R1 and R2 are “not equivalent” and the same, or when the results R1 and R2 are not the same, the cause of the abnormality can be searched. .

  The determination in the result collating units 27 and 37 may provide a determination as to whether the sensors 3 and 4 and the electronic control devices 8 and 9 are normal. For example, when the result in the signal matching unit 25 or the signal matching unit 35 is “equivalent”, in the result matching units 27 and 37, the result R1 of the first processing device 11 and the result R2 of the second processing device 12 Can be determined that the sensors 3 and 4 and the electronic control devices 8 and 9 are normal. On the other hand, when the result in the signal matching unit 25 or the signal matching unit 35 is “equivalent”, the result matching unit 27, 37 has the result R 1 of the first processing device 11 and the result R 2 of the second processing device 12. Is inconsistent, it can be determined that the electronic control devices 8 and 9 not including the sensors 3 and 4 are abnormal.

  The determination in the result collating units 27 and 37 is an abnormality of at least a part of the sensors 3 and 4 and the electronic control devices 8 and 9 or an abnormality of the electronic control devices 8 and 9 not including the sensors 3 and 4. May provide a determination of whether there is. For example, when the result in the signal matching unit 25 or the signal matching unit 35 is “not equivalent”, the result matching unit 27, 37 has the result R 1 of the first processing device 11 and the result R 2 of the second processing device 12. Can be determined that at least a part of the sensors 3 and 4 and the electronic control devices 8 and 9 are abnormal. On the other hand, when the result in the signal matching unit 25 or the signal matching unit 35 is “not equivalent”, the result matching unit 27, 37 has the result R 1 of the first processing device 11 and the result R 2 of the second processing device 12. And the electronic control devices 8 and 9 that do not include the sensors 3 and 4 can be determined to be abnormal.

  The fail safe control units (FSCM) 28 and 38 provide fail safe control according to the abnormality when any abnormality is determined. As fail-safe control, limp home control for controlling the internal combustion engine 5a so as to allow limited vehicle travel, or stop control by system shutdown or the like can be provided. All the processing devices 11, 12, and 13 include a fail-safe control unit that executes fail-safe processing instead of the normal control unit when abnormality of the sensor or the processing device is determined by the signal matching units 25 and 35.

  The fail safe control unit 28 can execute fail safe control using only the output signal S1 input directly. In addition, the fail safe control unit 38 can execute fail safe control using only the output signal S2 that is directly input. Therefore, even if there is an abnormality in the sensor 3 or the host HV control device 8, the internal combustion engine 5a can be controlled to a desired state. For example, even when the control amount commanded from the HV control device 8 cannot be used, the fail safe control unit 38 controls the internal combustion engine 5a based on the output signal S2 so as to enable traveling according to the user's request. Control.

  FIG. 2 shows a control process 150 executed in both the HV control device 8 and the EG control device 9. In the figure, the processing in the first processing apparatus 11 is mainly illustrated. In the drawing and the following description, reference numerals in the case of the second processing device 12 are shown in parentheses.

  In step 151, the output signal S1 (S2) is input from the sensor 3 (4). Here, only one of the output signals S1 and S2 is input to only one of the processing devices 11 and 12, and the other of the output signals S1 and S2 is input to only the other of the processing devices 11 and 12. That is, the plurality of processing devices 11 and 12 and the plurality of output signals S1 and S2 are associated one-to-one.

  In step 152, it is determined whether or not the output signal S1 (S2) is within a normal range. Here, a lower limit value LL that can be taken by the output signal S1 (S2) and an upper limit value UL that can be taken by the output signal S1 (S2) are used. Here, when the output signal S1 (S2) exceeds the lower limit value LL and falls below the upper limit value UL (LL <S1 (S2) <UL), it is determined that the output signal S1 (S2) is within the normal range. . When the output signal S1 (S2) is equal to or lower than the lower limit value LL (S1 (S2) ≦ LL) or when the output signal S1 (S2) is equal to or higher than the upper limit value UL (S1 (S2) ≧ UL) It is determined that it is out of the normal range. When the output signal S1 (S2) is within the normal range, the process proceeds to step 153. If the output signal S1 (S2) is outside the normal range, the process proceeds to step 161.

  In step 153, transmission / reception processing for sharing the output signal S1 and the output signal S2 is executed between the first processing device 11 and the second processing device 12. In step 153, the output signal S1 (S2) input in step 151 is transmitted. Further, in step 153, the output signal S2 (S1) transmitted from the other processing device 12 (11) is received.

  In step 154, it is evaluated whether or not the output signal S1 and the output signal S2 are equivalent. If the output signal S1 and the output signal S2 are equivalent, the process proceeds to step 155. If the output signal S1 and the output signal S2 are not equivalent, the process proceeds to step 156. The result R1 is obtained by the determination in step 154 of the HV controller 8. The result R2 is obtained by the determination in step 154 of the EG control device 9.

  In step 155, transmission / reception processing for sharing the result of the determination in step 154 is executed between the first processing device 11 and the second processing device 12. Also in step 156, transmission / reception processing for sharing the result of determination in step 154 is executed between the first processing device 11 and the second processing device 12. In steps 155 and 156, the result R1 (R2) in step 154 is transmitted. Further, in steps 155 and 156, the result R2 (R1) transmitted from the other processing device 12 (11) is received.

  In step 157, it is determined whether the result R1 and the result R2 are the same. When the result R1 and the result R2 are the same in step 157, the result R1 (R2) indicates “equivalent”, so both the results R1 and R2 are “equivalent”. In this case, the process proceeds to step 159. In this case, the abnormality of the sensors 3 and 4 is not detected in step 152, and the determination results R1 and R2 in step 154 are “equivalent” and coincide. Therefore, it can be determined that the sensors 3 and 4 and the electronic control devices 8 and 9 are normal.

  If the result R1 and the result R2 do not match in step 157, the result R1 (R2) indicates “equivalent” and the result R2 (R1) indicates “not equivalent”. In this case, the process proceeds to step 162. In this case, the abnormality of the sensors 3 and 4 is not detected in step 152, and the determination results R1 and R2 in step 154 do not match. Therefore, it can be determined that the electronic control devices 8 and 9 that do not include the sensors 3 and 4 are abnormal. Here, it cannot be specified which of the electronic control devices 8 and 9 is abnormal.

  In step 158, it is determined whether the result R1 and the result R2 are the same. When the result R1 and the result R2 do not match in step 158, the result R1 (R2) indicates “not equivalent” and the result R2 (R1) indicates “equivalent”. In this case, the process proceeds to step 162. In this case, the abnormality of the sensors 3 and 4 is not detected in step 152, and the determination results R1 and R2 in step 154 do not match. Therefore, it can be determined that the electronic control devices 8 and 9 that do not include the sensors 3 and 4 are abnormal. Here, it cannot be specified which of the electronic control devices 8 and 9 is abnormal.

  When the result R1 and the result R2 are the same in step 158, the result R1 (R2) indicates “not equivalent”, and therefore both the results R1 and R2 are “not equivalent”. In this case, the process proceeds to step 163. In this case, the abnormality of the sensors 3 and 4 is not detected in step 152, and the determination results R1 and R2 in step 154 coincide with each other by "not equivalent". However, since it is determined as “not equivalent” in step 154, an abnormality that can be detected by the comparison process in step 154, such as an offset of the output signal or an abnormality in detection characteristics, has occurred in sensor 3 or sensor 4. A case is assumed. Therefore, it can be determined that at least some of the sensors 3 and 4 and the electronic control devices 8 and 9 are abnormal. Here, it cannot be specified which of the sensors 3 and 4 and the electronic control devices 8 and 9 is abnormal.

  In steps 161-163, an abnormality process for fail-safe control is executed. In step 161, a first abnormality process is executed. Step 161 is executed when an abnormality of the sensor 3 (4) is detected. In this step, the occurrence of abnormality is notified to the vehicle user. In this step, the abnormality of the sensor 3 (4) is notified to the other processing device 12 (11). In this step, the function of the processing device 11 (12) is limited. For example, the function of the processing device 11 (12) is limited to such an extent that the vehicle can perform limited travel. More specifically, in this step, control is executed so that the vehicle can perform limited retreat travel called limp home travel. At this time, when one of the HV control device 8 and the EG control device 9 maintains a normal function, the normal control device provides limited control based on an output signal input thereto. For example, when the HV control device 8 becomes abnormal and the EG control device 9 is normal, the EG control device 9 can continue the control based on the output signal S2. At this time, an adverse effect from the abnormal HV control device 8 is suppressed. For example, when the EG control device 9 becomes abnormal and the HV control device 8 is normal, the HV control device 8 can continue the control based on the output signal S1. At this time, at least the MG control device 10 can function normally.

  In step 162, the second abnormality process is executed. Step 162 is executed when there is an abnormality in the HV control device 8 or the EG control device 9. In this step, the occurrence of abnormality is notified to the vehicle user. In this step, the determination result that any one of the control devices is abnormal is notified to the other processing device 12 (11). In this step, the function of the processing device 11 (12) is limited. The function restriction provided here may be the same as the function restriction provided in step 161. Furthermore, the function of the processing device 11 (12) may be completely stopped after the function restriction or instead of the function restriction. For example, the processing apparatus 11 (12) can be shut down.

  In step 163, a third abnormality process is executed. Step 163 is executed when any one of the sensor 3, the sensor 4, the HV control device 8, and the EG control device 9 has an abnormality. In this step, the occurrence of abnormality is notified to the vehicle user. In this step, the determination result that any one of the sensor and the control device is abnormal is notified to the other processing device 12 (11). In this step, the function of the processing device 11 (12) is limited. The function restriction provided here may be the same as the function restriction provided in step 161. Furthermore, the function of the processing device 11 (12) may be completely stopped after the function restriction or instead of the function restriction.

  As described above, according to this embodiment, the output signals S1 and S2 of the duplicated sensor 2 are input to the different processing devices 11 and 12, and the output signals S1 and S2 are acquired by communication and collated. Therefore, an abnormality related to the transmission path of the output signal can be detected. The abnormality detected here includes an abnormality belonging to the sensor and an abnormality belonging to the control device. In addition, since the output signals are collated in both of the plurality of processing devices 11 and 12, an abnormality can be detected in any of the processing devices 11 and 12.

  Moreover, since the output signals S1 and S2 of the duplicated sensor 2 are input to the different processing devices 11 and 12, even if one processing device 11 (12) becomes abnormal, the other processing device 12 (11) The output signal S2 (S1) input to itself can be used. As a result, it is possible to provide control while suppressing adverse effects from other processing apparatuses 11 (12).

(Second Embodiment)
In this embodiment, in addition to the above-described embodiment, a self-diagnosis function for diagnosing whether the self is normal or abnormal is further provided. In FIG. 3, the first processing device 11 and the second processing device 12 include self-diagnosis units (DIGM) 229 and 239. The self-diagnosis units 229 and 239 diagnose whether or not the functions of the processing devices 11 and 12 are normal. By providing the self-diagnosis units 229 and 239, the processing device 11 (12) can determine by itself whether or not its function is normal. In this embodiment, the processing apparatuses 11 and 12 do not include a result communication unit and a result collation unit. In this embodiment, since the self-diagnosis units 229 and 239 can detect the abnormality of the processing device 11 (12) by themselves, when the signal matching units 25 and 35 determine “not equivalent”, the other processing devices 12 ( This is because it can be determined that 11) is abnormal.

  In FIG. 4, the control processing 250 executed in both the HV control device 8 and the EG control device 9 will be described. In step 270, it is determined whether or not the self-diagnosis result in the self-diagnosis units 229 and 239 is “abnormal”. If “abnormal” of the processing apparatus 11 (12) is detected in step 271, the process proceeds to step 272.

  The processing in steps 151-154, 159, 161 is the same as that in the preceding embodiment.

  In step 263, a fifth abnormality process is executed. Step 263 is executed when either sensor 3 or sensor 4 is abnormal. When step 263 is reached, since it is already determined in step 271 that the processing device 11 (12) itself is normal, the “inequalities” of the output signals S1 and S2 are abnormalities related to the sensors 3 and 4. It can be considered to be caused. In this step, the occurrence of abnormality is notified to the vehicle user. In this step, the determination result that any one of the sensors is abnormal is notified to the other processing device 12 (11). In this step, the function of the processing device 11 (12) is limited. The function restriction provided here may be the same as the function restriction provided in step 161. Alternatively, the desired one as the vehicle is selected from the control amount commanded from the HV control device 8 and the control amount uniquely calculated by the EG control device 9, and the traveling device 5 is selected based on the selected control amount. May be controlled. For example, it is possible to select a control amount that reduces the amount of movement of the vehicle or a control amount that changes the amount of movement of the vehicle. Furthermore, the function of the processing device 11 (12) may be completely stopped after the function restriction or instead of the function restriction.

  In step 272, a fifth abnormality process is executed. Step 272 is executed when there is an abnormality in the processing device 11 (12) itself. In this step, the occurrence of abnormality is notified to the vehicle user. In this step, the abnormality of the processing device 11 (12) is notified to the other processing device 12 (11). In this step, the function of the processing device 11 (12) is limited. The function restriction provided here may be the same as the function restriction provided in step 161. Furthermore, the function of the processing device 11 (12) may be completely stopped after the function restriction or instead of the function restriction.

  In this embodiment, since the processing apparatuses 11 and 12 are provided with a self-diagnosis function, an abnormal processing apparatus can be identified.

(Third embodiment)
In the said embodiment, the structure which the 1st processing apparatus 11 and the 2nd processing apparatus 12 monitor mutually was employ | adopted. Instead of or in addition to this, the third processing device 313 may perform evaluation and / or verification of the output signals S1 and S2. Furthermore, in addition to the above embodiment, the third processing device 313 may identify the cause or location of the abnormality based on the determination results of three or more processing devices. For example, an abnormal processing device may be specified by applying a majority vote to the results of three or more determinations.

  In FIG. 5, the MG control device 10 includes a third processing device (MPU 3) 313. The processing device 313 includes a plurality of functional blocks 42-48, 40. The function blocks 42 to 48 included in the third processing device 313 provide the same or corresponding functions as the function blocks 22 to 28 included in the first processing device 11. The signal communication units 23, 33, and 43 and the signal verification units 25, 35, and 45 are provided in the three processing devices 11, 12, and 313.

  The normal control unit 42 executes a control process for controlling the motor generator 5b in accordance with a command from the HV control device 8. The normal control unit 42 of the MG control device 10 outputs both the output signal S1 input indirectly via the HV control device 8 and the output signal S2 input indirectly via the EG control device 9. Configured to be available. Therefore, in the MG control apparatus 10, high reliability is obtained. The signal communication unit 43 receives the signals processed in the signal processing units 21 and 31. The signal evaluation unit 44 evaluates whether both the output signal S1 and the output signal S2 are within a preset normal range. The signal matching unit 45 determines whether or not the output signals S1 and S2 are equivalent. Therefore, in this embodiment, the signal communication unit 43 and the signal matching unit 45 are provided in the third processing device 313 that is not connected to the first sensor 3 or the second sensor 4. The result communication unit 46 receives the result of determination in the signal matching units 25 and 35. The result communication unit 46 obtains the determination results R1-R3 in the plurality of signal matching units 25, 35, 45. The result matching unit 47 determines whether the results R1 and R2 match. The fail safe control unit 48 provides fail safe control according to an abnormality.

  The majority processing unit 40 identifies the abnormal processing device by executing the majority processing based on the results R1 and R2 and the determination result R3 obtained by the signal matching unit 452. Here, two processing devices that output a majority result are treated as normal, and one processing device that outputs a minority result is treated as abnormal. In this embodiment, the fail safe control unit 48 performs fail safe control according to the determination result in the majority processing unit 40.

  In FIG. 6, the control process 350 executed in the MG control apparatus 10 will be described. In step 353, the output signals S1 and S2 are received via the HV control device 8 and the EG control device 9.

  In step 352, it is determined whether or not both output signals S1 and S2 are within the normal range. When both the output signals S1 and S2 are within the normal range, the process proceeds to step 354. If the output signal S1 or the output signal S2 is outside the normal range, the process proceeds to step 361.

  In step 354, it is evaluated whether or not the output signal S1 and the output signal S2 are equivalent. If the output signal S1 and the output signal S2 are equivalent, the process proceeds to step 355. If the output signal S1 and the output signal S2 are not equivalent, the process proceeds to step 356. As a result of the determination in step 354, a result R3 is obtained. In steps 355 and 366, the result R1 is received from the HV control device 8, and the result R2 is received from the EG control device 9.

  In step 357, it is determined whether or not the three results R1, R2, and R3 are the same. If the results R1, R2, R3 are the same in step 357, the results R1, R2, R3 are “equivalent”. In this case, the process proceeds to step 359. If the results R1, R2, and R3 do not match in step 357, the process proceeds to step 380.

  In step 358, it is determined whether or not the three results R1, R2, and R3 are the same. If the results R 1, R 2, R 3 do not match in step 358, the process proceeds to step 381. If the results R1, R2, R3 are the same in step 358, the results R1, R2, R3 are “not equivalent”. In this case, the process proceeds to step 363.

  In step 381, majority processing is executed. In step 381, the processing device that outputs the minority result is specified. Step 382 branches according to the minority result. If the result R1 is a minority, the process proceeds to step 383. If the result R2 is a minority, the process proceeds to step 384. If the result R3 is a minority, the process proceeds to step 385.

  In steps 361, 363, and 383-385, abnormality processing for fail-safe control is executed. In step 361, the first abnormality process similar to that in step 161 is executed. In step 363, a third abnormality process similar to that in step 163 is executed.

  In step 383, failsafe control is executed when the first processing apparatus 11 that outputs the result R1 is abnormal. In this step, the occurrence of abnormality is notified to the vehicle user. In this step, the abnormality of the first processing device 11 is notified to the other processing device 12. In the EG control device 9, in response to the notification from the MG control device 10, fail-safe control is executed on the assumption that the HV control device 8 is abnormal. In this step, the MG control device 10 restricts its function on the assumption that the HV control device 8 is abnormal. The function restriction provided here may be the same as the function restriction provided in step 161. Furthermore, the function of the third processing device 313 may be completely stopped after the function restriction or instead of the function restriction. Further, the function of the first processing apparatus 11 that becomes abnormal may be completely stopped.

  In step 384, failsafe control is executed when the second processing device 12 that outputs the result R2 is abnormal. In this step, the occurrence of abnormality is notified to the vehicle user. In this step, the abnormality of the second processing device 12 is notified to the other processing device 11. In the HV control device 8, in response to the notification from the MG control device 10, fail-safe control is executed on the assumption that the EG control device 9 is abnormal. In this step, the MG control device 10 restricts its function on the assumption that the EG control device 9 is abnormal. The function restriction provided here may be the same as the function restriction provided in step 161. Furthermore, the function of the third processing device 313 may be completely stopped after the function restriction or instead of the function restriction. Further, the function of the second processing apparatus 12 that has become abnormal may be completely stopped.

  In step 385, fail safe control is executed when the third processing device 313 that outputs the result R3 is abnormal. In this step, the occurrence of abnormality is notified to the vehicle user. In this step, the abnormality of the third processing device 313 is notified to the other processing devices 11 and 12. In the HV control device 8 and the EG control device 9, fail-safe control is executed in response to a notification from the MG control device 10 on the assumption that the MG control device 10 is abnormal. In this step, the MG control device 10 restricts its function. The function restriction provided here may be the same as the function restriction provided in step 161. Furthermore, the function of the third processing device 313 may be completely stopped after the function restriction or instead of the function restriction.

  In this embodiment, the output signals S1 and S2 are collated by three or more processing devices, and the result of the collation is evaluated by majority vote, whereby the control device that has become abnormal can be identified.

(Other embodiments)
The preferred embodiments of the present invention have been described above, but the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention. The structure of the said embodiment is an illustration to the last, Comprising: The scope of the present invention is not limited to the range of these description. The scope of the present invention is indicated by the description of the scope of claims, and further includes meanings equivalent to the description of the scope of claims and all modifications within the scope.

  For example, the means and functions provided by the control device can be provided by software only, hardware only, or a combination thereof. For example, the control device may be configured by an analog circuit.

  Moreover, in the said embodiment, the signal communication parts 23 and 33 and the signal collation parts 25 and 35 were provided in the 1st processing apparatus 11 and the 2nd processing apparatus 12. FIG. Instead, the signal communication units 23 and 33 and the signal matching units 25 and 35 can be provided in the first processing device 11 and / or the second processing device 12.

  Moreover, in the said embodiment, the signal evaluation parts 24 and 34, the signal collation parts 25 and 35, and the result collation parts 27 and 37 were provided in both the 1st processing apparatus 11 and the 2nd processing apparatus 12. FIG. Instead, the signal evaluation units 24 and 34 and the signal matching units 25 and 35 may be provided only in the first processing device 11 or the second processing device 12. Further, the signal evaluation units 24 and 34 and the signal matching units 25 and 35 may be provided only in the third processing device 313.

  Moreover, in the said embodiment, the three control apparatuses 8, 9, and 10 were provided, and the processing apparatuses 11, 12, 13, 313 were each provided. Instead of this, a plurality of processing devices may be provided in one control device. For example, the first processing device 11 and the second processing device 12 may be provided in the first control device. Further, three processing devices 11, 12, and 13 may be provided in a single control device.

  In the above embodiment, communication between a plurality of processing devices is provided by a communication line. Instead of this, a dedicated signal line may be provided. For example, a signal line for transmitting the output signal S1 from the first processing device 11 to the second processing device 12 can be provided.

  In the above embodiment, the sensor 2 detects the operation amount of the accelerator pedal. Instead of this, the sensor 2 may detect an operation amount of a brake pedal operated by a user of the vehicle. Moreover, the sensor 2 may detect the operation position of the shift lever operated by the user of the vehicle.

  Also in the third embodiment, the self-diagnosis unit exemplified in the second embodiment may be provided in all the processing apparatuses.

  DESCRIPTION OF SYMBOLS 1 Control apparatus for vehicles, 2 Sensor, 3 1st sensor, 4 2nd sensor, 5 Traveling equipment, 6 Drive wheel, 7 Electronic control system, 8 1st control apparatus, 9 2nd control apparatus, 10 1st 3 control device, 11 first processing device, 12 second processing device, 13 third processing device, 21 signal processing unit, 22 normal control unit, 23 signal communication unit, 24 signal evaluation unit, 25 signal verification unit , 26 result communication unit, 27 result verification unit, 28 fail-safe control unit.

Claims (7)

A first sensor (3) for detecting one event and generating a first output signal (S1);
A second sensor (4) for detecting the same event and generating a second output signal (S2);
A first processing device (11) to which the first sensor is connected and the first output signal (S1) is input;
A second processing device (12) to which the second sensor is connected and the second output signal (S2) is input;
A signal communication unit (23, 33, 43, 153, 353) for obtaining the first output signal and the second output signal;
A signal verification unit (25, 35, 45, 154, 354) that compares the first output signal with the second output signal to determine abnormality of the sensor or the processing device. The vehicle control device. All the processing devices
A normal control unit (22, 32, 42, 159, 359) for executing normal control processing based on the output signal;
A fail-safe control unit (28, 38, 48, 161-163, 263, 272) that executes fail-safe processing instead of the normal control unit when the signal collation unit determines that the sensor or the processing device is abnormal. 361, 363, 383-385). The vehicle control device according to claim 1, wherein   The signal evaluation unit (24, 34, 44, 152, 352) for evaluating whether the first output signal or the second output signal is within a normal range is further provided. The vehicle control device according to claim 2.   The said signal communication part and the said signal collation part are provided in the said 1st processing apparatus and / or the said 2nd processing apparatus, The any one of Claims 1-3 characterized by the above-mentioned. Vehicle control device.   2. The signal processing unit and the signal matching unit are provided in a third processing device (313) that is not connected to the first sensor or the second sensor. The vehicle control device according to claim 4. The signal communication unit and the signal verification unit are provided in a plurality of the processing devices,
further,
A result communication unit (26, 36, 46, 155, 156, 355, 356) for obtaining the determination results (R1, R2) in the plurality of signal matching units;
A result collating unit (27, 37, 47, 157, 158, 357, 358) for collating a plurality of the results and determining whether or not the results are the same is provided. The vehicle control device according to claim 5. The signal communication unit and the signal verification unit are provided in the three processing devices (11, 12, 313),
further,
A result communication unit (46, 355, 356) for obtaining the determination results (R1-R3) in the plurality of signal verification units;
The vehicular control device according to claim 5, further comprising a majority processing unit (40, 381, 382) that identifies the abnormal processing device by a plurality of majority of the results.

Images